Confidentiality is the starting point, with specified exceptions
Section 158 of the CGST Act protects the specified statements, returns, accounts, documents and proceeding records from disclosure, subject to subsection (3). It is not an absolute prohibition on every official use. A release file should identify the information, recipient, legal purpose and precise exception before disclosure. This guide concerns information in the public-servant/statutory setting; it does not create a general commercial right to obtain another taxpayer’s records.
Read the applicable text: CBIC CGST Act: section 158 ICAI April 2026 statutory text: sections 158, 158A and 159.
Match the recipient and purpose
Subsection (3) contains distinct routes for prosecution, implementation of the Act, lawful notice service or recovery, specified civil proceedings, tax-receipt/refund audit, officer-conduct inquiries and other governmental or statutory functions. A government email address alone does not establish every exception. Record why the requested particulars fit the actual recipient and function, with the requisition or other authority supporting the conclusion.
Vendor processing is not open-ended reuse
Section 158(3)(j) addresses agencies appointed for data entry or operation, upgrade or maintenance of an automated system where the agency is contractually bound not to use or disclose the particulars except for those purposes. Check the appointment, contractual restriction and task scope. Commercial analytics, marketing or unrelated reuse cannot be justified merely by calling a supplier a technology vendor.
Keep publication decisions distinct
Section 158(3)(l) concerns information about classes of taxable persons or transactions for publication where the Commissioner considers publication desirable in the public interest. Section 159 separately deals with publication concerning persons in certain cases. Do not use a class-information release as shorthand for publishing a named taxpayer’s penalty case. For the CGST clause (l) power, section 168(2) identifies a Commissioner or Joint Secretary posted in the Board, acting with Board approval. Section 159(2) bars publication relating to a penalty until the section 107 appeal time expires without an appeal, or an appeal filed is disposed of. Verify the particular route and its safeguards before describing information as publicly publishable.
Consent-based portal sharing is another route
Section 158A separately addresses sharing specified details by the common portal with notified systems, subject to the statutory consent and prescribed conditions. It overrides specified provisions for that route; it is not proof that every section 158(3) disclosure requires taxpayer consent or that any private recipient with a consent form becomes eligible for portal access. Identify the route before applying its conditions.
Make the release auditable
As recommended operational controls, retain an item-level inventory, purpose mapping, approval trail, recipient verification and transmission evidence. Remove unrelated material where it is outside the supported disclosure scope. Page counts, monetary totals and redaction percentages in the illustrations are control calculations, not statutory safe harbours, fines or automatic approval thresholds.
Six worked illustrations
All facts and amounts are fictional. Calculations illustrate the stated assumptions, not a predetermined legal outcome.
Illustrative example 1: Scope the requested period
A file has 120 monthly-record pages, but the supported requisition covers a subset of 35 pages. The other 85 pages require a separate scope basis rather than automatic attachment. Relevance and authority, not the 29.17% approximate release fraction, determine what may be disclosed.
Illustrative example 2: Check a vendor population
A processor’s authorised task covers 8,000 rows. A proposed export contains 10,500 rows, leaving 2,500 outside that task. Reconcile the extra rows and contractual scope before transfer; appointing the vendor does not establish a purpose for unrelated records.
Illustrative example 3: Remove unrelated attachments
A package contains 46 relevant pages and nine unrelated pages, totalling 55. Removing the nine leaves 46. Retain the original and the release copy so the reviewer can verify scope without assuming that removal alone establishes legal authority.
Illustrative example 4: Reconcile figures without exposing every account
A supported class-information working totals ₹24 lakh, ₹18 lakh and ₹8 lakh, or ₹50 lakh. A draft summary shows ₹54 lakh, a ₹4 lakh difference. Resolve that difference and verify the publication route; accurate arithmetic alone does not authorise publication or establish sufficient anonymisation.
Illustrative example 5: Separate request categories
A request inventory has 16 items: ten supported by the identified exception, four needing clarification and two outside scope. The total is 16, but only ten are presently supported. A blanket approval of the request would conceal six unresolved items.
Illustrative example 6: Reconcile the dispatched version
The approved package has 72 pages. The transmitted attachment contains 68 approved pages plus seven unapproved pages, or 75. Four approved pages are missing and seven require review. A net difference of three pages would understate the two distinct control failures.
Ten-step verification table
| Step | Action | Evidence |
|---|---|---|
| 1 | Identify protected particulars | Record type and source proceeding. |
| 2 | Capture the request | Recipient, purpose and requested period. |
| 3 | Select the legal route | Exact section 158(3) clause or separate provision. |
| 4 | Verify recipient eligibility | Role, appointment and authority evidence. |
| 5 | Test purpose fit | Item-level necessity and scope analysis. |
| 6 | Check vendor restrictions where relevant | Appointment and contractual use/disclosure limit. |
| 7 | Separate publication or portal-sharing cases | Applicable statutory route and conditions. |
| 8 | Reconcile the release inventory | Pages, rows, totals and excluded material. |
| 9 | Approve and transmit securely | Approval, correct recipient and version evidence. |
| 10 | Archive the release record | Actual dispatched copy and acknowledgement. |
Sixteen practitioner FAQs
1. Is section 158 an absolute secrecy rule?
No. Read its specified exceptions and separate applicable statutory routes.
2. Can a private customer demand another supplier’s return under it?
It creates no general commercial disclosure entitlement.
3. Does any government recipient qualify automatically?
Match the actual recipient, function and exception.
4. Must every official disclosure depend on taxpayer consent?
Do not import section 158A conditions into every section 158(3) exception.
5. What does clause (j) require of an agency?
The specified appointment and contractual restriction on use and disclosure.
6. Does a vendor contract permit marketing reuse?
The clause does not authorise unrelated commercial reuse.
7. Are all automated-system tasks covered regardless of purpose?
No. Match the task and appointment to the statutory description.
8. Can a class-information provision justify every named-person publication?
No. Distinguish the publication routes and their conditions.
9. Who forms the public-interest opinion under clause (l)?
Read section 158(3)(l) with section 168(2): for this CGST power, a Commissioner or Joint Secretary posted in the Board exercises it with Board approval.
10. Is section 159 identical to section 158?
No. It addresses publication in specified cases separately.
11. Does anonymisation alone establish disclosure authority?
No. Verify both authority and the actual released content.
12. Are the example percentages legal thresholds?
No. They are inventory controls only.
13. Does a correct aggregate total prove the package is proper?
No. Item relevance, recipient and statutory purpose still matter.
14. What if part of a request lacks support?
Separate supported, clarification-needed and unsupported items.
15. Why preserve the transmitted version?
It proves what was actually released, not merely what was approved.
16. What is the practical closing record?
The request, legal mapping, scope inventory, approval and dispatch evidence.
Official sources
CBIC CGST Act: section 158 ICAI April 2026 statutory text: sections 158, 158A and 159